fix(mcp): hide managed workflows without a session

src/server/createServer.ts

@@ -179,20 +179,21 @@ export const createServer = (
     activeTarget,
     recordEvidence,
   });
-  registerManagedWorkflowTools(server, {
-    logger: toolLogger,
-    recordEvidence,
-    recordEvidenceWithUnknown,
-    session,
-    runtime: {
-      policy: options.managedRuntimePolicy ?? {
-        enabled: false,
-        roots: [],
-        executablePath: "/usr/bin/dotnet",
+  if (session !== undefined)
+    registerManagedWorkflowTools(server, {
+      logger: toolLogger,
+      recordEvidence,
+      recordEvidenceWithUnknown,
+      session,
+      runtime: {
+        policy: options.managedRuntimePolicy ?? {
+          enabled: false,
+          roots: [],
+          executablePath: "/usr/bin/dotnet",
+        },
+        authority: options.permissionAuthority,
       },
-      authority: options.permissionAuthority,
-    },
-  });
+    });
   registerBrowserTools(server, {
     logger: toolLogger,
     browser: options.browserObservation,

src/server/registerManagedWorkflowTools.ts

@@ -15,11 +15,8 @@ import {
 import { managedMemberComparisonResultSchema } from "../domain/managedMemberComparison.js";
 import { managedReconstructionImportInputSchema } from "../domain/managedReconstruction.js";
 import type { Evidence } from "../domain/evidence.js";
-import {
-  EvidenceIntegrityError,
-  EvidenceReferenceError,
-} from "../domain/errors.js";
-import { err, type Result } from "../domain/result.js";
+import type { EvidenceIntegrityError } from "../domain/errors.js";
+import type { Result } from "../domain/result.js";
 import type { Logger } from "../logger.js";
 import { logToolExecution } from "./toolLogging.js";
 import { toCallToolResult } from "./toolResult.js";
@@ -34,7 +31,7 @@ interface ManagedWorkflowToolRegistration {
     | BinarySessionPort["recordEvidenceWithUnknown"]
     | undefined;
   readonly runtime: ManagedRuntimeCorrelationDependencies;
-  readonly session: BinarySessionPort | undefined;
+  readonly session: BinarySessionPort;
 }
 
 /** Register provider-neutral managed-code workflows. */
@@ -198,24 +195,13 @@ const contract = (
 };
 
 const resolveManagedEvidence = (
-  session: BinarySessionPort | undefined,
+  session: BinarySessionPort,
   evidenceIds: readonly string[],
-): Result<Evidence[], EvidenceIntegrityError> => {
-  const firstId = evidenceIds[0] ?? "ev_missing";
-  return session === undefined
-    ? err(
-        new EvidenceReferenceError(
-          firstId,
-          "missing",
-          "inspect_managed_members",
-          null,
-        ),
-      )
-    : resolveSessionEvidenceIds(session, evidenceIds, {
-        operation: "inspect_managed_members",
-        predicate: "rea.analysis/v2",
-       });
-};
+): Result<Evidence[], EvidenceIntegrityError> =>
+  resolveSessionEvidenceIds(session, evidenceIds, {
+    operation: "inspect_managed_members",
+    predicate: "rea.analysis/v2",
+  });
 
 const recordSources = (
   recordEvidence: ManagedWorkflowToolRegistration["recordEvidence"],

tests/createServer.test.ts

@@ -21,6 +21,9 @@ describe("beta.3 server composition", () => {
     await server.connect(serverTransport);
     await client.connect(clientTransport);
     expect(client.getInstructions()).not.toContain("open_binary");
+    const names = (await client.listTools()).tools.map(({ name }) => name);
+    expect(names).not.toContain("compare_managed_members");
+    expect(names).not.toContain("plan_managed_runtime_correlation");
     await client.close();
     await server.close();
   });